home

yct.exe

aTube Catcher

No Organization Affiliation

The application yct.exe, “aTube Catcher to download and convert videos.” by No Organization Affiliation has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address adf4d195.setaptr.net on port 80 using the HTTP protocol.
Publisher:
DsNET  (signed by No Organization Affiliation)

Product:
aTube Catcher

Description:
aTube Catcher to download and convert videos.

Version:
3.08.7925

MD5:
8c79a788a711cf213ffda4c1ade41853

SHA-1:
e613557850ca84dd1fa28f6cd368f503a9124db3

SHA-256:
0b8db67bf157bf898ed0aa149086af2368e7546c290d5b7fc964e3a1fd1cbd5e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 9:38:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.ATubeCatcher.Installer.Meta (M)
16.4.23.9

File size:
6.4 MB (6,677,344 bytes)

Product version:
3.08.7925

Copyright:
Diego Uscanga

Original file name:
yct.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\dsnet corp\atube catcher 2.0\yct.exe

Digital Signature
Signed by:
No Organization Affiliation

Authority:
VeriSign, Inc.

Valid from:
2/27/2014 12:00:00 AM

Valid to:
2/26/2017 11:59:59 PM

Subject:
CN=Diego Uscanga, OU=Individual Developer, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=No Organization Affiliation, L=Huixquilucan, S=Mexico, C=MX

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3891D1349D41A2C39A519812D8C15FAC

File PE Metadata
Compilation timestamp:
3/22/2014 1:55:28 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:nDinF+n/5Q6GDHF5kYdpafLpHe35ynOKwA3GoAsj02fv:DEF+n/5Q6MHF5kYdpafLde35yD

Entry address:
0x29080

Entry point:
68, D8, 9C, 42, 00, E8, F0, FF, FF, FF, 00, 00, 48, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, A1, 73, 9E, 3D, A4, 5D, 86, 4C, B5, 20, E0, C7, A4, 91, 49, FC, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 61, 54, 75, 62, 65, 43, 61, 74, 63, 68, 65, 72, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 17, 00, 00, 00, 33, 6D, 16, 7B, 1E, 57, DC, 47, BA, 6B, AC, 89, 2C, 13, 19, E9, 01, 00, 00, 00, A0, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
6.3 MB (6,574,080 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to adf4d195.setaptr.net  (173.244.209.149:80)

Remove yct.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.